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Application Layer 
SMTP, POP3, FTP 


Transport Layer 
(TCP, UDP) 


Network Layer 
(IP, ICMP, IGMP) 
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Application Layer 
TTP, SMTP, POP3, FTP el 


Transport Layer 
(TCP, UDP) 


Network Layer 
(IP, ICMP, IGMP) 


Link Layer 
(Ethernet, Serial Link etc.] 
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Joe Bloggs 
67.227.117.77 



56k Dial-up- 
Connection 




The Internet i 



Intermediary server 
.on the Internet (www.gkn.net), 
65.225.115.65 



Dedicated T1 
Connection 



HTie orang.com main office 
Private Network 
(1.251.174.0) 




1.251.174.0 



Restrictive Firewal 
1.251.174.1,64.224 




(out only) 
114.64 



mail server 
(mail.orang.com) 
1.251.174.155 



network router 
1.251.174.158 



proxy client 
1.251.174.156 




web server 
(www.orang.com) 
1.251.174.157 
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Client 



Intermediary 



Proxy Client 



Server 




Register Virtual 
Address (VA) 



Warn Administrator 
of Connection Error 



Keep Open Proxy 
Client Connection and 
wait for client requests 



Send a request for 
service to a virtual 
address on the 
Intermediary 



Interpret Request to 
identify Correct Proxy 
Client Connection 



Transform the 
Request VA to a 
Real Application 
Address^Request 



Send Request to 
waiting Open Proxy 
Client Connection 



Receive Server 
Response 



Translate any Real 
Application Addresses 
into Virtual Addresses 



Receive Response 



Return Response to 
Client 



Break Connection 
with Intermediary 



Break Connection 
with Proxy Client 



Receive Client 
Request 



Open a Client 
Connection to the 
Server and Send 
through the Request 



Receive Response 

and Return to 
Intermediary through 
Open Connection 



Start a new^ 
Proxy Client 
! Connection and) 
Registration 
Process 



Receive Request, 
Interpret, Action and 
Send back the 
Response 
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Client 
Server 



c] 
s] 



Modified Router 
Modified Router 



Intermediary 



Proxy Client 
Proxy Client 





Register Virtual 
Address (VA) 



Warn 
Administrator of 
Connection Error 



Send a network 
datagram destined 
for the opposite 
network (routed via 
the Modified 
Router) 



Keep Open Proxy 
Connection and 
wait for client 
requests 




Add a Virtual Address 

Header and 
authentication data for 
the opposite network 



Interpret Request 
Header to identify 
Correct Proxy Client 
Connection 



Datagram 
Routed to 
Modified Router 
at the Link Layer 



Drop Modified Router 
Header and wait for 
encapsulated datagram 



Receive datagram, 
interpret, action and 

reply with a 
datagram destined 
for the Opposite 
Network 



Send encapsulated 
datagram to Opposite 
Newtork through Open 
Proxy Client Connection 



Receive network 
datagram 



Datagram Repeated on 
Opposite Network 



Repeat the datagram 
through the physical 
link layer 



I 



Break Connection to 
Intermediary and Start a 
Fresh Registration 
Process 




